CVE-2026-102857 – Microsoft Office Visio Remote Code Execution Vulnerability

A critical remote code execution (RCE) vulnerability has been identified in Microsoft Office Visio. The vulnerability allows an unauthorized attacker to execute malicious code by convincing a user to open a specially crafted Visio file. The flaw involves a heap-based buffer overflow caused by an off-by-one error in memory handling. With a CVSS score of 8.8, the vulnerability poses significant risks to confidentiality, integrity, and availability. Although exploitation is currently considered less likely, the low attack complexity and lack of required attacker privileges make this vulnerability particularly concerning for organizations using affected Microsoft Office products.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability creates a serious security risk because attackers can potentially execute malicious code on a vulnerable system through a specially crafted Visio file.

An attacker does not need existing access or special privileges to attempt exploitation. However, successful exploitation requires a user to open the malicious file.

The vulnerability has a network-based attack vector and low attack complexity, making it a potential target for document-based attacks.

Successful exploitation could compromise sensitive business information, allow unauthorized changes to files, or disrupt business operations.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability has not been publicly disclosed, and there are no reported instances of active exploitation.

The exploit code maturity is classified as Unproven, meaning the existence of publicly available exploit code or proof-of-concept (PoC) code is not confirmed.

There is also no indication that this vulnerability is currently being exploited as a zero-day.

However, the vulnerability’s low attack complexity and lack of required attacker privileges make it important to address before exploitation becomes more likely.

Technical Summary

CVE-2026-102857 is a critical remote code execution vulnerability affecting Microsoft Office Visio.

The vulnerability originates from a heap-based buffer overflow (CWE-122) associated with an off-by-one error (CWE-193).

An off-by-one error occurs when software incorrectly calculates or processes the boundary of a memory buffer. This can cause data to be written beyond the allocated memory space, potentially corrupting adjacent memory.

In this case, the memory-handling weakness could allow an attacker to trigger unintended behavior and potentially execute malicious code.

To exploit the vulnerability, an attacker must create a specially crafted file and convince a user to open it in an affected Microsoft Office environment.

Once the malicious file is opened, the vulnerability could be triggered, potentially allowing the attacker to execute code on the targeted system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Microsoft has also confirmed that the Preview Pane is not an attack vector for this vulnerability.

The combination of low attack complexity and high potential impact makes this vulnerability a significant concern, particularly in environments where users frequently exchange and open Office documents.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)

An attacker could exploit the vulnerability by distributing a specially crafted Visio file and convincing a user to open it.

No attacker privileges are required, but user interaction is necessary.

Exploitation is currently assessed as less likely, and no active exploitation has been reported.

Specific affected build numbers are not identified.

Business Impact

This vulnerability presents a significant risk to organizations that rely on Microsoft Office applications for daily business operations.

A successful attack could allow malicious code execution on an employee’s workstation, potentially compromising sensitive business information and disrupting critical activities.

The potential business consequences include:

• Data Exposure: Attackers could potentially access confidential documents, financial records, or sensitive business information.
• System Compromise: Malicious code execution could enable unauthorized activities on affected systems.
• Operational Disruption: Compromised systems could experience application failures, instability, or interruptions to business operations.
• Data Integrity Risks: Attackers could potentially modify or destroy important business files.
• Financial and Reputational Damage: Security incidents could result in recovery costs, lost productivity, and reduced customer confidence.

The vulnerability is particularly concerning because attackers do not require existing privileges to initiate exploitation.

“A single malicious document could put sensitive information, employee systems, and business operations at risk.”

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

Until the security update can be deployed, organizations should consider the following precautions:

• Avoid opening Visio files from unknown or untrusted sources.
• Educate employees about suspicious documents and phishing attempts.
• Use email security controls to help detect and block malicious attachments.
• Restrict unnecessary access to Visio documents where practical.
• Prioritize installation of the official Microsoft security update.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical Priority – Prompt Patching Recommended

CVE-2026-102857 should be prioritized for deployment because of its Critical severity rating, CVSS score of 8.8, and potential for remote code execution.

Although there are no reported active exploits and exploitation is currently considered less likely, the vulnerability has several characteristics that increase its security significance.

The attack requires no existing attacker privileges, has low attack complexity, and could result in serious confidentiality, integrity, and availability impacts.

Organizations using affected Microsoft 365 Apps for Enterprise or Office LTSC installations should prioritize applying the official Microsoft security update.

Delaying this patch leaves systems exposed to malicious documents that could turn routine file-sharing activities into serious security incidents.